svn commit: r352674 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Wed Sep 25 10:42:34 2019
New Revision: 352674
URL: https://svnweb.freebsd.org/changeset/base/352674

Log:
  MFC r352550:
  
  Fix the handling of invalid parameters in ASCONF chunks.
  Thanks to Mark Wodrich from Google for reproting the issue in
  https://github.com/sctplab/usrsctp/issues/376
  for the userland stack.

Modified:
  stable/12/sys/netinet/sctp_asconf.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_asconf.c
==============================================================================
--- stable/12/sys/netinet/sctp_asconf.c	Wed Sep 25 10:40:49 2019	(r352673)
+++ stable/12/sys/netinet/sctp_asconf.c	Wed Sep 25 10:42:34 2019	(r352674)
@@ -703,6 +703,7 @@ sctp_handle_asconf(struct mbuf *m, unsigned int offset
 		if (param_length <= sizeof(struct sctp_paramhdr)) {
 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 			sctp_m_freem(m_ack);
+			return;
 		}
 		/* get the entire parameter */
 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);